Class File

Information about a file.

Inheritance

object

File

Implements

IMessage<File>

IEquatable<File>

IDeepCloneable<File>

IBufferMessage

IMessage

Inherited Members

object.GetHashCode()

object.GetType()

object.ToString()

Namespace: Google.Backstory

Assembly: Google.Backstory.dll

Syntax

public sealed class File : IMessage<File>, IEquatable<File>, IDeepCloneable<File>, IBufferMessage, IMessage

Constructors

File()

Declaration

public File()

File(File)

Declaration

public File(File other)

Parameters

Type	Name	Description
File	other

Properties

Ahash

Deprecated. Use authentihash instead.

Declaration

[Obsolete]
public string Ahash { get; set; }

Property Value

Type	Description
string

AppCompatCache

Windows AppCompatCache (Application Compatibility) metadata.

Declaration

public AppCompatMetadata AppCompatCache { get; set; }

Property Value

Type	Description
AppCompatMetadata

Authentihash

Authentihash of the file.

Declaration

public string Authentihash { get; set; }

Property Value

Type	Description
string

CapabilitiesTags

Capabilities tags.

Declaration

public RepeatedField<string> CapabilitiesTags { get; }

Property Value

Type	Description
RepeatedField<string>

CreateTime

Timestamp when the file was created.

Declaration

public Timestamp CreateTime { get; set; }

Property Value

Type	Description
Timestamp

EmbeddedDomains

Embedded domains found in the file.

Declaration

public RepeatedField<string> EmbeddedDomains { get; }

Property Value

Type	Description
RepeatedField<string>

EmbeddedIps

Embedded IP addresses found in the file.

Declaration

public RepeatedField<string> EmbeddedIps { get; }

Property Value

Type	Description
RepeatedField<string>

EmbeddedUrls

Embedded urls found in the file.

Declaration

public RepeatedField<string> EmbeddedUrls { get; }

Property Value

Type	Description
RepeatedField<string>

ExifInfo

Exif metadata from different file formats extracted by exiftool.

Declaration

public ExifInfo ExifInfo { get; set; }

Property Value

Type	Description
ExifInfo

FileMetadata

Metadata associated with the file. Deprecate FileMetadata in favor of using fields in File.

Declaration

[Obsolete]
public FileMetadata FileMetadata { get; set; }

Property Value

Type	Description
FileMetadata

FileType

FileType field.

Declaration

public File.Types.FileType FileType { get; set; }

Property Value

Type	Description
File.Types.FileType

FirstSeenTime

Timestamp the file was first seen in the customer's environment.

Declaration

public Timestamp FirstSeenTime { get; set; }

Property Value

Type	Description
Timestamp

FirstSubmissionTime

First submission time of the file.

Declaration

public Timestamp FirstSubmissionTime { get; set; }

Property Value

Type	Description
Timestamp

FullPath

The full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.

Declaration

public string FullPath { get; set; }

Property Value

Type	Description
string

LastAccessTime

Timestamp when the file was accessed.

Declaration

public Timestamp LastAccessTime { get; set; }

Property Value

Type	Description
Timestamp

LastAnalysisTime

Timestamp the file was last analysed.

Declaration

public Timestamp LastAnalysisTime { get; set; }

Property Value

Type	Description
Timestamp

LastModificationTime

Timestamp when the file was last updated.

Declaration

public Timestamp LastModificationTime { get; set; }

Property Value

Type	Description
Timestamp

LastSeenTime

Timestamp the file was last seen in the customer's environment.

Declaration

public Timestamp LastSeenTime { get; set; }

Property Value

Type	Description
Timestamp

LastSubmissionTime

Last submission time of the file.

Declaration

public Timestamp LastSubmissionTime { get; set; }

Property Value

Type	Description
Timestamp

MainIcon

Icon's relevant hashes.

Declaration

public Favicon MainIcon { get; set; }

Property Value

Type	Description
Favicon

Md5

The MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

Declaration

public string Md5 { get; set; }

Property Value

Type	Description
string

MimeType

The MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".

Declaration

public string MimeType { get; set; }

Property Value

Type	Description
string

Names

Names fields.

Declaration

public RepeatedField<string> Names { get; }

Property Value

Type	Description
RepeatedField<string>

Ntfs

NTFS metadata.

Declaration

public NtfsFileMetadata Ntfs { get; set; }

Property Value

Type	Description
NtfsFileMetadata

PdfInfo

Information about the PDF file structure.

Declaration

public PDFInfo PdfInfo { get; set; }

Property Value

Type	Description
PDFInfo

PeFile

Metadata about the Portable Executable (PE) file.

Declaration

public FileMetadataPE PeFile { get; set; }

Property Value

Type	Description
FileMetadataPE

PrefetchFileMetadata

Metadata about the prefetch file.

Declaration

public PrefetchFileMetadata PrefetchFileMetadata { get; set; }

Property Value

Type	Description
PrefetchFileMetadata

Prevalence

Prevalence of the file hash in the customer's environment.

Declaration

public Prevalence Prevalence { get; set; }

Property Value

Type	Description
Prevalence

SecurityResult

Google Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.

Declaration

public SecurityResult SecurityResult { get; set; }

Property Value

Type	Description
SecurityResult

Sha1

The SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

Declaration

public string Sha1 { get; set; }

Property Value

Type	Description
string

Sha256

The SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

Declaration

public string Sha256 { get; set; }

Property Value

Type	Description
string

SignatureInfo

File signature information extracted from different tools.

Declaration

public SignatureInfo SignatureInfo { get; set; }

Property Value

Type	Description
SignatureInfo

Size

The size of the file in bytes.

Declaration

public ulong Size { get; set; }

Property Value

Type	Description
ulong

Ssdeep

Ssdeep of the file

Declaration

public string Ssdeep { get; set; }

Property Value

Type	Description
string

StatDev

The file system identifier to which the object belongs.

Declaration

public ulong StatDev { get; set; }

Property Value

Type	Description
ulong

StatFlags

User defined flags for file.

Declaration

public uint StatFlags { get; set; }

Property Value

Type	Description
uint

StatInode

The file identifier. Unique identifier of object within a file system.

Declaration

public ulong StatInode { get; set; }

Property Value

Type	Description
ulong

StatMode

The mode of the file. A bit string indicating the permissions and privileges of the file.

Declaration

public ulong StatMode { get; set; }

Property Value

Type	Description
ulong

StatNlink

Number of links to file.

Declaration

public ulong StatNlink { get; set; }

Property Value

Type	Description
ulong

Symhash

SymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.

Declaration

public string Symhash { get; set; }

Property Value

Type	Description
string

Tags

Tags for the file.

Declaration

public RepeatedField<string> Tags { get; }

Property Value

Type	Description
RepeatedField<string>

Vhash

Vhash of the file.

Declaration

public string Vhash { get; set; }

Property Value

Type	Description
string